Commit Graph

22 Commits

Author SHA1 Message Date
cec4893db9 feat(security): Implement SysWarden Evolution #1-3 security enhancements
Evolution #1 - IP Blocklist (secubox-app-ipblocklist, luci-app-ipblocklist):
- Pre-emptive blocking layer with ipset (~100k IPs)
- Default sources: Data-Shield, Firehol Level 1
- Supports nftables (fw4) and iptables backends
- LuCI KISS dashboard with sources/whitelist management

Evolution #2 - AbuseIPDB Reporter (luci-app-crowdsec-dashboard v0.8.0):
- New "AbuseIPDB" tab in CrowdSec Dashboard
- crowdsec-reporter.sh CLI for reporting blocked IPs
- RPCD handler luci.crowdsec-abuseipdb with 9 methods
- Cron job for automatic reporting every 15 minutes
- IP reputation checker in dashboard

Evolution #3 - Log Denoising (luci-app-system-hub v0.5.2):
- Three modes: RAW, SMART (noise ratio), SIGNAL_ONLY (filter known IPs)
- Integrates with IP Blocklist ipset + CrowdSec decisions
- RPCD methods: get_denoised_logs, get_denoise_stats
- Denoise mode selector panel with noise ratio indicator

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-20 20:11:24 +01:00
6298e8b961 refactor(crowdsec): Simplify LuCI interface - KISS setup
- Remove unused views: metrics.js, waf.js, wizard.js
- Remove unused CSS: wizard.css, soc.css
- Remove settings.js, replace with simplified setup.js
- Update menu: remove WAF, Metrics entries
- Update nav.js: remove references to deleted pages
- Add status grid CSS for setup page

The new Setup page provides:
- System status overview (Agent, LAPI, CAPI, Bouncer)
- Console enrollment form
- Service controls (start/stop/restart/repair)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-02 10:56:13 +01:00
fce6307c7e fix(crowdsec-dashboard): Move to Security menu and fix stats display
- Move CrowdSec from Services to Security & Access menu
- Fix get_decisions() to return {"decisions":[]} not {"alerts":[]}
- Fix active_bans to use local_decisions count instead of parsing
  unreliable metrics output

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-01 05:36:01 +01:00
31f4db881e refactor(crowdsec-dashboard): KISS rewrite and move to Services menu
- Rewrite all views with KISS CSS (1200+ lines removed)
- Use unified cs-* CSS prefix with SecuBox theme variables
- Move CrowdSec from Security to Services menu
- Update navigation paths in all views and nav.js
- Add CSS loading in each view's load() function
- Fix Services menu as proper firstchild submenu
- Simplify dashboard.css from 950+ to 112 lines

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-31 06:51:13 +01:00
931c4b1dfc fix(crowdsec-dashboard): Add ACL permissions for settings methods
Add get_settings to read permissions and save_settings to write permissions
to fix RPC access denied error (-32002) on the settings page.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-31 05:44:59 +01:00
2b913d5005 feat(p2p): Add SecuBox P2P Hub packages and Services Registry
- Add secubox-p2p backend package:
  - UCI configuration for P2P settings, DNS federation, WireGuard mesh, HAProxy
  - RPCD handler for peer management, service discovery, mesh configuration
  - Init script and main P2P manager daemon

- Add luci-app-secubox-p2p frontend package:
  - Main hub view with master control, network matrix visualization
  - Peers management with discovery and manual add
  - Services view showing local and shared services
  - Mesh network configuration (DNS, WireGuard, HAProxy)
  - Settings for P2P and registry configuration

- Add Services Registry view to luci-app-secubox
- Add listProfiles/applyProfile to secubox-admin API
- Fix P2P ACL permissions
- Remove old hub.js from luci-app-secubox (moved to dedicated package)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-30 19:46:28 +01:00
f70e7e959f fix(crowdsec-dashboard): Add UCI ubus permissions to ACL
Add ubus uci method permissions:
- Read: get, state, configs
- Write: set, add, delete, rename, order, commit, apply, confirm, rollback

Fixes "Permission denied" error when saving theme settings.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-30 19:46:28 +01:00
78d43855be fix(crowdsec-dashboard): Move menu to SecuBox security section
Move CrowdSec dashboard from admin/services/crowdsec to
admin/secubox/security/crowdsec to integrate with SecuBox menu structure.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-30 19:46:28 +01:00
6f7ee8e8c2 refactor(menu): Move CrowdSec and Threat Monitor to Services menu
- CrowdSec: admin/secubox/security/crowdsec -> admin/services/crowdsec
- Threat Monitor: admin/secubox/security/threats -> admin/services/threat-monitor

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-30 19:46:26 +01:00
fd7caeb8c3 fix(crowdsec-dashboard): Fix typo in ACL (seccubox_logs -> secubox_logs)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-14 12:20:12 +01:00
239a68f9de fix(crowdsec-dashboard): Add get_overview to ACL permissions
The new get_overview RPC method was missing from the ACL file,
causing "Access denied" errors in the frontend.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-14 12:19:58 +01:00
5b55ab3ef9 feat: Dashboard reorganization and auth security fixes
- Move Debug Console from Client Guardian to System Hub
- Add Auto-Zoning Rules dedicated view in Client Guardian
- Add public pages for Bug Bounty and Crowdfunding (no ACL)
- Fix auth-logger to only detect real login attempts
- Add private IP whitelist for CrowdSec (RFC1918 ranges)
- Update navigation menus across all apps
- Bump secubox-auth-logger to v1.2.2

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-14 09:32:14 +01:00
d1bc9a9b63 feat(crowdsec-dashboard): Add system health check and CAPI metrics
- Add health_check API with LAPI/CAPI/Console status verification
- Add capi_metrics API for community blocklist statistics
- Add hub_available, install_hub_item, remove_hub_item APIs
- Add System Health panel to overview with visual status indicators
- Add CAPI Blocklist section showing community vs local decisions
- Add Installed Collections card with version display
- Fix settings.js syntax error (missing comma)
- Fix metrics.js null display in acquisition statistics
- Update ACL file with new RPC method permissions

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-12 17:08:29 +01:00
4b1e0f3405 feat: Add realtime acquisition statistics to CrowdSec metrics view
New features:
- New RPCD method: acquisition_metrics for detailed stats
- Realtime metrics display with 10-second polling
- Visual stat cards: lines read, parsed, unparsed, buckets
- Parse rate progress bar with color coding
- Active acquisition sources badges
- Rate calculation (events/sec) between polls
- Live update indicator with timestamp

API changes:
- Added getAcquisitionMetrics() to API layer
- Added acquisition_metrics to ACL permissions

Bumped version to 0.7.0-17

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-11 07:29:48 +01:00
252341e045 feat: Add complete CrowdSec integration for OpenWrt 24.10+
New packages:
- secubox-crowdsec-setup: Automated installation script with:
  - Prerequisites verification (RAM, flash, OpenWrt version)
  - syslog-ng4 configuration for log forwarding
  - CAPI registration and hub setup
  - nftables firewall bouncer configuration
  - Backup/rollback, repair, and uninstall modes

- luci-app-secubox-crowdsec: LuCI dashboard with:
  - Service status and statistics dashboard
  - Active decisions (bans) management
  - Security alerts viewer
  - Collections and bouncers management
  - UCI-based settings configuration

Enhanced existing packages:
- luci-app-crowdsec-dashboard: Added acquisition configuration wizard
- secubox-app-crowdsec: Improved defaults and configuration

Documentation:
- CROWDSEC-OPENWRT-24.md with architecture, installation, and troubleshooting

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 17:58:17 +01:00
327cc5b285 feat: Add smart action buttons and fix CrowdSec settings display (v0.6.0-r29)
- Add service control RPCD method (start/stop/restart/reload)
- Add smart action buttons to CrowdSec Settings (Service Control, Register Bouncer, Hub Update)
- Add CrowdSec Console quick access link button
- Fix LAPI status check (use lapi_status field)
- Fix collections display (handle nested response structure)
- Fix System Hub Quick Status Indicators layout (label/value stacking)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-08 15:02:03 +01:00
e5b6d1dd87 feat: Add CrowdSec Console enrollment to setup wizard (v0.6.0-r28)
- Add console_status, console_enroll, console_disable RPCD methods
- Insert Console enrollment as Step 2 in the 7-step wizard
- Add API declarations and ACL permissions for console operations
- Enable share_manual_decisions, share_tainted, share_context by default on enrollment

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-08 14:40:24 +01:00
4078b4d7a4 feat: Add LAPI auto-repair and SecuBox theming to CrowdSec Dashboard (v0.6.0-r27)
- Add repair_lapi() RPCD method to auto-fix LAPI configuration issues:
  - Creates /srv/crowdsec/data directory if missing
  - Fixes data_dir and db_path in config.yaml
  - Re-registers localhost machine if needed
  - Restarts CrowdSec and verifies LAPI is working

- Fix register_bouncer() to handle existing bouncers:
  - Deletes existing bouncer before re-registering
  - Gets fresh API key on re-registration

- Fix update_firewall_bouncer_config() UCI path:
  - Changed from crowdsec.bouncer.$key to crowdsec.@bouncer[0].$key
  - Added api_key to allowed parameters

- Rewrite metrics.js with SecuBox cyber-card theming:
  - Use Theme.init() for proper theme initialization
  - Replace cs-* classes with cyber-* classes
  - Add CSS variable fallbacks for light/dark theme support
  - Fix hub data parsing for proper component counts

- Add theme require to wizard.js

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-08 14:11:16 +01:00
ad2e89fd47 feat: CrowdSec Setup Wizard - Complete First-Time Installation (v0.6.0)
Major Features:
- Add comprehensive 6-step setup wizard for CrowdSec initial configuration
- Automated hub update, collection installation, and bouncer configuration
- Complete turnkey solution requiring zero manual configuration

Wizard Flow:
1. Welcome & Prerequisites - Check CrowdSec and LAPI status
2. Update CrowdSec Hub - Fetch latest security collections
3. Install Collections - Pre-selected security packs (ssh-bf, http-cve, linux)
4. Configure Firewall Bouncer - Auto-register with API key generation
5. Enable & Start Services - Start bouncer and verify nftables
6. Verification & Summary - Show completion status with statistics

UI Components:
- Visual stepper with active/complete/pending states
- Real-time progress indicators and status badges
- Auto-advancement after successful operations
- Professional dark-themed styling with animations
- Fully responsive design (mobile/tablet/desktop)

New Files:
- htdocs/luci-static/resources/view/crowdsec-dashboard/wizard.js (815 lines)
- htdocs/luci-static/resources/crowdsec-dashboard/wizard.css (578 lines)

Backend Enhancements:
- Add check_wizard_needed() RPC method for first-time setup detection
- Add wizard_state() RPC method for wizard initialization
- Update API module with wizard method declarations
- Add wizard menu item (order: 5, appears first in CrowdSec section)
- Update ACL permissions for wizard RPC methods

User Experience:
- < 2 minute complete CrowdSec setup from fresh install
- Clear visual feedback at each step
- Error handling with retry capability
- Final verification shows all systems operational

Version: 0.6.0-1

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-07 08:39:41 +01:00
82d1aa37aa fix: Add ACL permissions for firewall bouncer RPC methods
Added missing RPCD ACL permissions for the new firewall bouncer
management methods to resolve "Access denied" errors.

ACL Changes:
- Added read permissions:
  * firewall_bouncer_status - Get service and nftables status
  * firewall_bouncer_config - Read UCI configuration
  * nftables_stats - Get blocked IPs and rules statistics

- Added write permissions:
  * control_firewall_bouncer - Start/stop/restart/enable/disable service
  * update_firewall_bouncer_config - Modify UCI settings

These permissions allow the bouncers page to fully manage the firewall
bouncer service through the LuCI web interface.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-06 20:26:01 +01:00
4dd8884549 fix(luci-app-crowdsec-dashboard): Correct ACL dependency in menu
Changed menu dependency from 'luci-app-crowdsec' to 'luci-app-crowdsec-dashboard'
to match the actual ACL name, making CrowdSec visible in LuCI interface.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-06 15:52:53 +01:00
31a87c5d7a feat(structure): reorganize luci-app packages into package/secubox/ + appstore migration
Major structural reorganization and feature additions:

## Folder Reorganization
- Move 17 luci-app-* packages to package/secubox/ (except luci-app-secubox core hub)
- Update all tooling to support new structure:
  - secubox-tools/quick-deploy.sh: search both locations
  - secubox-tools/validate-modules.sh: validate both directories
  - secubox-tools/fix-permissions.sh: fix permissions in both locations
  - .github/workflows/test-validate.yml: build from both paths
- Update README.md links to new package/secubox/ paths

## AppStore Migration (Complete)
- Add catalog entries for all remaining luci-app packages:
  - network-tweaks.json: Network optimization tools
  - secubox-bonus.json: Documentation & demos hub
- Total: 24 apps in AppStore catalog (22 existing + 2 new)
- New category: 'documentation' for docs/demos/tutorials

## VHost Manager v2.0 Enhancements
- Add profile activation system for Internal Services and Redirects
- Implement createVHost() API wrapper for template-based deployment
- Fix Virtual Hosts view rendering with proper LuCI patterns
- Fix RPCD backend shell script errors (remove invalid local declarations)
- Extend backend validation for nginx return directives (redirect support)
- Add section_id parameter for named VHost profiles
- Add Remove button to Redirects page for feature parity
- Update README to v2.0 with comprehensive feature documentation

## Network Tweaks Dashboard
- Close button added to component details modal

Files changed: 340+ (336 renames with preserved git history)
Packages affected: 19 luci-app, 2 secubox-app, 1 theme, 4 tools

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-01 14:59:38 +01:00